In the Linux kernel, the rfcomm_recv_frame() function casts incoming skb data to a struct rfcomm_hdr and dereferences its fields without verifying that the skb contains sufficient bytes. A truncated or zero‑length frame causes an out‑of‑bounds read of uninitialized memory; the zero‑length case may reduce skb->len to the maximum unsigned value and causes skb_tail_pointer() to read far beyond the allocated buffer. These memory leaks can expose kernel data and other sensitive information. The underlying weakness is a classic lack of input validation and bounds checking, leading to an information exposure flaw.

All installations of the Linux kernel that contain the vulnerable RFCOMM stack, particularly systems with Bluetooth enabled, are affected. The flaw exists in all kernel versions prior to the inclusion of commit 67dc3b40fae71b6b11c71e7ff69bac0758818c05 which added the missing length check.

No CVSS score is presently available and the EPSS score is not provided, but the absence of an exploited vulnerability in the KEV catalog suggests no publicly documented attacks. Nevertheless, the vulnerability could be leveraged remotely by an attacker who can send crafted Bluetooth RFCOMM frames to the target, potentially exposing kernel memory contents. The risk is moderate to high for systems with active Bluetooth services and insufficient protection against rogue devices.